From Obligation to Enforcement Point: A Deficit-Driven Method for Placing AI Governance Controls in Enterprise Architectures

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Enterprises deploying AI systems have no shortage of governance obligations, but regulations and standards stop short of the step an architect must take: deriving an obligation’s enforcement architecture — where enforcement should occur, what information must cross architectural boundaries, and what remains unenforceable. A long-recognised systems tension, captured by the end-to-end argument and the semantic gap, recurs here: locations with broad enforcement coverage often operate through general interfaces that abstract away the application-specific state — such as purpose, entitlement, objective, and contextual sensitivity — needed to evaluate context-dependent obligations, while the locations holding that state can be bypassed. We call this mediation–abstraction coupling and use it as a diagnostic, not as a new observation. The central contribution is a cause-sensitive selection rule, the Deficit-Cause Principle: after establishing what candidate locations actually know, mediate, and can do, the method diagnoses why a required fact or capability is unavailable at an adequate enforcement point and selects the class of architectural response from that cause: enforce locally, transport a fact, transport a verdict, approximate and detect, or declare a residual. The resulting enforcement architecture is the composition of these responses. We evaluate the method through four studies: a development corpus drawn from regulation and standards, a held-out applicability study, a pre-specified test of twelve obligations from sources excluded from method development, and fourteen documented AI platforms, frameworks and research systems. In the sealed pre-specified test, the frozen method returned a placement for eleven of twelve obligations, ten of them through a cause diagnosis; the twelfth had no adequate enforcement cut, a case the method does not yet route. Across the documented cases, documentation agreed with or extended eight predictions (two involving no deficit), contradicted two, was indeterminate for one, and in three was coded as showing a gap flagged in the prediction. These results are exploratory, single-analyst corroboration of applicability; whether cause-sensitive selection outperforms cause-blind alternatives is untested.